Strengthening themes, plugins and core installation to prevent intrusion.

learn more… | top users | synonyms

23
votes
3answers
11k views

Getting a List of Currently Available Roles on a WordPress Site?

When writing WordPress plugins there is often a need to set up options for which roles on the site have access to certain functionality or content. To do this a plugin dev needs to fetch the list of ...
0
votes
0answers
19 views

Vanilla Wordpress install, what can/should I put in disable_functions?

I would like to take steps to limit the damage a compromised Wordpress install can cause on the rest of my system. What system calls does Wordpress need? What can I put in the disable_functions ...
0
votes
1answer
24 views

How do I diagnose a plugin resource 404?

I'm doing some work for a new client (non-tech, their former tech person left). Their version of Wordpress is 4.3.2. The site gets some JavaScript errors on load. Using the Console I noticed two ...
18
votes
6answers
13k views

Can I Prevent Enumeration of Usernames?

Can I prevent enumeration of usernames on my wordpress site? I can see users at the moment using the WPScan tool.
2
votes
1answer
44 views

Do you need to escape hard coded plain text?

I started playing with the Underscores starter theme and noticed it uses esc_html_e() even on plain text: <a class="skip-link" href="#content"><?php esc_html_e( 'Skip to content', '_s' ); ...
1
vote
1answer
31 views

Using esc_url with a hard coded url

I've added following URL in my theme, but I have been informed that I must use esc_url(). I could not figure out, how can I use that function with following code? <a ...
0
votes
2answers
2k views

How to secure or disable the RSS feeds?

I'm trying to set up WordPress as a CMS. As such, I want to disable the feeds since it's mostly a secured site. I've gone through all the Settings pages but found no setting to tweak or disable the ...
0
votes
0answers
41 views

PHP Code Sniffer - WordPress VIP Coding Standards

I'm trying to fix up my code to meet the WordPress VIP Coding Standards. I'm getting a couple of issues that I'd like to see go away, but i'm not sure what the best strategy is. The first issue is ...
0
votes
2answers
57 views

Security: blocking direct access of php files

I found 2 ways to block direct access to php files (although it's not always necessary, see http://wordpress.stackexchange.com/a/63004/60539) The first one is: defined( 'ABSPATH' ) or die( 'No script ...
2
votes
2answers
45 views

Is the “lost password” feature truly a vulnerability?

Disabling Password Resets I've come across numerous security hardening articles relating to various measures for disabling password resets (i.e. lost password retrieval). ...
1
vote
1answer
19 views

Handling email piping attachments and detecting unsupported file types

I have a plugin that I am working on which uses Email Piping. When an email is processed I want all the attachments from the email to be added to the WordPress Media Library. Currently I am using ...
0
votes
1answer
17 views

Webservice credential storage [duplicate]

I am developing a plugin that calls a web-service with a security header. Can anyone recommend a best practice for storing those credentials on the WordPress site? Right now my best option seems to be ...
2
votes
2answers
1k views

how can i embed wordpress backend in iframe

I have 2 websites http://www.aaa.com and http://www.bbb.com and need it show the same. now i put iframe in index.html and upload to aaa.com. it's ok for frontend but it's doesn't work for backend, ...
1
vote
2answers
83 views

site get login attempts after htaccess ip restriction

I'm using a security plugin that keep sending me emails: "A lockdown event has occurred due to too many failed login attempts or invalid username: Username: Admin IP Address: 195.154.243.31 IP ...
0
votes
1answer
21 views

Adding Security Keys?

I read the paragraph at the codex on Security Keys. It offers the example - define( 'AUTH_KEY', 't`DK%X:>xy|e-Z(BXb/f(Ur`8#~UzUQG-^_Cs_GHs5U-&Wb?pgn^p8(2@}IcnCa|' ); define( ...
0
votes
3answers
36 views

Directory to store secure file

I have a website hosted on ASP.NET server and using wordpress to build my site. I've extended its functionalities using PHP code. At which directory do I store secure files such as (passwords and ...
1
vote
0answers
21 views

Hacked site is now Generating Users..What can we do? [closed]

Our site is hacked and auto-registering 1 new user/3min. What we did so far : 1- Added Captcha on all the registration pages 2- Changed the superAdmin pswd 3- upgraded WP to 4.4 4- upgraded all ...
1
vote
1answer
33 views

How Restrict access to admin dashboard by specific static ip?

i'm trying to restrict access to admin dashboard (wp-admin.php) by specific static ip so tried to add .htaccess to the wp-admin and set <FilesMatch "admin\.php$"> Order deny,allow Deny from ...
1
vote
2answers
64 views

Developing a secure front end post editing form

I want to add a front end post editing functionality to one of my Wordpress sites. I found a few plugins that do this, but they don't fits all my needs, so I decided to adapt an existing solution to ...
3
votes
2answers
292 views

What is the wp-includes/certificates/ca-bundle.crt used for?

I'm working on a Wordpress site and I stumbled upon that certificate. I would like to know what it is for. Is Wp using it in any way? Can I delete it (or move it outside the document root)? Thanks
0
votes
1answer
105 views

Developing a secure front end posting form

I want to add a front end posting functionality to one of my Wordpress sites. For more control and for more understanding of how this works (I am not a professional programmer) I choosed to use as a ...
0
votes
0answers
17 views

Access passworded post with URL

I'm using Woocommerce to sell memberships which users must apply for and I've passworded them all to prevent unauthorized purchases. The best solution for me would be to have a link which 'unlocks' ...
0
votes
0answers
41 views

AJAX - nonce verification fails

I have a simple add-to-newsletter widge. I created a hidden input with nonce: $nlnonce = wp_create_nonce("add-newsletter"); echo '<input type="hidden" id="nlnonce" value="'.$nlnonce.'" />'; ...
1
vote
2answers
81 views

Limit access to wp_admin

I'm attempting to limit access to wp_admin by IP address but I still have a few that are getting through. I have an htaccess file in my wp_admin folder with the following: # Block access to wp-admin. ...
-2
votes
2answers
192 views

How to Find WordPress site has backdoor login Codes

This is a very common question. There are plenty of plugins available in WordPress Plugins directory Under GPL. And many plugins have some backdoor login attempts. So, can't trust which plugin is ...
0
votes
0answers
13 views

Download security

I would like to create a secure download link for digital content e.g. PDFs, Zips etc. There's a few plugins that offer "secure downloads" but they just block the download page. I need it so the ...
8
votes
1answer
96 views

Why does wordpress have more then one salt

I guess I am exposing here some lack of security knowledge, but shouldn't it be enough to have one salt? why does there need to be four different ones define('AUTH_SALT', ...
0
votes
1answer
80 views

Force SSL on a single page which is used as iFrame

I have one WordPress page that only contains a shortcode for a slider and is used by other websites as an iFrame. I need to force SSL one this one single page, but whatever I try, it is not being ...
0
votes
1answer
40 views

WordPress security [closed]

I created a website for my customer via wordpress and I uploaded it in their server ..we assume the user have the access in the whole server ..is it possible to protect this website from being used in ...
0
votes
1answer
22 views

How to protect Wordpress from security scanner [closed]

I wondered how can we protect our wordpress site from security fail scanner (ex: wpscsan) or scanner that gives info like if our site is using wordpress, plugins and theme (ex: What WordPress Theme Is ...
0
votes
1answer
79 views

Being hacked. Is there a list of Wordpress security holes I can check against?

I observe a file being uploaded into various plugin folders in my Wordpress site. The file is used to send out spam from my server and every time I remove it it gets uploaded to another folder. There ...
18
votes
3answers
9k views

Increase of failed login attempts, brute force attacks? [closed]

I Installed the plugin Simple Login Lockdown and since a couple of days ago the database is recording over 200 records by day. I think that is not possible to have my site attacked by so many IP's ...
0
votes
0answers
30 views

Some crawlers/bots attempting to login with very good guesses. How?

I am trying to figure out if wordpress exposes the user e-mail or any other user information to crawlers/bots? I have a couple of security plugins that have been blocking these bots IPs on the third ...
1
vote
2answers
130 views

Changing Table Prefix for an Existing WordPresss Site

Hoping someone can assist with Wordpress table prefix for an already established site. What is the best approach in changing the existing table prefix within both DB and wp-config file to reflect new ...
1
vote
4answers
5k views

How to remove “Connection Information” requirement on localhost install of WP on MACOSX

I've just installed XAMPP on Mac OSX and when trying to install a theme or plugin in WP admin, I'm getting this screen. I've never gotten this on my shared hosting account. how to get rid of it on ...
2
votes
1answer
138 views

How do I bypass Wordpress 404 handling?

How do I skip Wordpress altogether if there's a 404? I've tried adding an ErrorDocument to the .htaccess with no joy. The reason I'm asking is that we use a lot of custom fields and as such our site ...
0
votes
2answers
145 views

Allow SVG in WP step by step

I'm not strong in WP programming, bu I try to understand what to do to enable SVG in my site. I found that in need to add function below to functions.php: /** * Add SVG capabilities */ function ...
0
votes
1answer
62 views

Access log “POST /wp-login.php HTTP/1.0” 400

I'm looking the access log and I tried some lines as: IP - - [date and hour] "POST /wp-login.php HTTP/1.0" 400 ... What's the problem? Someone wants hack my blog? How can I resolve?
2
votes
2answers
93 views

Which ways can be used to log in to Wordpress?

FYI: This has been also posted here since I'm fairly new to this website and didn't know that the Wordpress part existed. Sorry for the repost. I'm currently trying to tighten the security for a ...
0
votes
1answer
31 views

Use Google authentication for pages within a website [closed]

We are trying to restrict certain pages of our website, and we use Google Apps for Business, so we were hoping we could leverage Google authentication. Everything I've found on the topic though is ...
0
votes
1answer
279 views

.htaccess password protection bypassed

I’ve created .htaccess password in order to add a layer of security to a WordPress installation. The .htpasswd file is located one level above the installation. Yet, I’ve seen brute force attack ...
0
votes
1answer
163 views

Downloading File from Outside Web Root

I've set up some code to download zip files that exist in a folder above the web root. The download will be triggered from a user account page within WordPress. They don't need to be bank-level ...
0
votes
2answers
135 views

brute force attack even though it is limited by IP

The security settings of a website we have was done according to Wordpress Recommendations and we did not have any single hacking attempts for months. Especially that wp-login.php and wp-admin are ...
0
votes
1answer
35 views

Hash user emails in database?

I have a wordpress based website, a very important thing is that no one should get to know the email addresses of the people who will admin. I will make the whole website private but I am still ...
0
votes
0answers
227 views

wp_verify_nonce fails always

I have created nonce fro my plugin and trying to verify it with another plugin pages. it fails always. both we are creating nonce with same parameter. why it fails. Plugin name : Wordfence it creates ...
1
vote
2answers
37 views

Assuming a theme is properly secured, how save is the WordPress admin?

Regarding point 3 in this (awesome) article on mikejolley.com. It states: Never trust user input, even that provided by admin users, because: You have no way of knowing the user is whom ...
0
votes
1answer
400 views

What is pclzip.lib.php file that wordfence think it's a malicious code

I have checked original wordpress and this file isn't there but this file comes back every time I deleted it. Do you think it's a malicious script? Path: /wp-admin/uploader/pclzip.lib.php Code: ...
0
votes
2answers
2k views

Block access to wp-admin

I'm attempting to use a .htaccess file to block access to the wp-admin folder. I've read through the Brute Force Attacks doc (https://codex.wordpress.org/Brute_Force_Attacks) and I've added the block ...
3
votes
4answers
754 views

Why should I use the esc_url?

This thing makes my coding difficult. Wordpress codex reasons the use of esc_url by talking vaguely about security. But is it really worth the trouble? For example, what's the important, practical ...
0
votes
1answer
41 views

How might I sanitize an XML file before WP Import? (Does wordpress verify or clean text when importing from an XML document? )

I have been tasked to import an older, offline wordpress site. I have the XML export file and a tar-ball of the file tree. Nothing has given me reason to worry, but does WP check the contents of the ...